cakefoundation vulnerabilities

Products

• cakephp 3

Latest cakefoundation CVEs

Newest publication first

1. CVE-2020-15400 Cross-Site Request Forgery in CakePHP

   Published 2020-06-30

   Medium·CVSS 4.3 EPSS 0.52%

   CakePHP before 4.0.6 mishandles CSRF token generation. This might be remotely exploitable in conjunction with XSS.

2. CVE-2012-4399 CakePHPallows remote attackers to read arbitrary files via XML data containing external entity references

   Published 2012-10-09

   High·CVSS 7.5 EPSS 12.1% Public exploit

   The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote attackers to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.

3. CVE-2010-4335 CakePHP allows remote attackers to modify internal Cake cache and execute arbitrary code

   Published 2011-01-14

   High·CVSS 7.5 EPSS 55.2% Framework module Public exploit

   The _validatePost function in libs/controller/components/security.php in CakePHP 1.3.x through 1.3.5 and 1.2.8 allows remote attackers to modify the internal Cake cache and execute arbitrary code via a crafted data[_Token][fields] value that is processed by the unserialize functi...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.